yes I do. I will take convivence over security most days. Just because you don’t, and you have good reasons to want it to stay, doesn’t mean everyone comes to the same conclusion based on similar data.
Although I personally think 2FA is very important in most cases, I agree that mandatory 2FA is annoying. If you want to forego security for convenience, that should be up to you. I’m sure you’re not stupid or ignorant of the risks.
as a developer it is incredibly frustrating and time consuming
Huh? How? Implementing OTP (which I’m assuming most people here are talking about) is pretty trivial, and once you have it set up, it doesn’t require much maintenance.
It fails for somebody every day, it adds a dependency for a known unreliable 3rd party that often mangles the identification data it sends back, it is exploited by that 3rd party for extending their monopoly, and it gives that 3rd party (or any hacker that got access to them) full access to impersonate any user it wants.
That’s the user’s choice, that should not be a consideration when choosing authentication methods as long as you tell them how to store it properly (in a reasonable way, probably shouldn’t mention keepass or anything like that).
This is uterly idiotic but ok. I have decided I do not need to wear seat belt in the car. Just because you do and you have good reasons to want it to stay, doesn’t mean everyone comes to the same conclusion based on similar data.
The day my taxes go towards paying for people who don’t have 2fa, we can discuss whether it should be mandatory. Also, comparing a compromised Netflix account to loss of life, really?
yes I do. I will take convivence over security most days. Just because you don’t, and you have good reasons to want it to stay, doesn’t mean everyone comes to the same conclusion based on similar data.
Good thing you aren’t in charge of anything, then.
Although I personally think 2FA is very important in most cases, I agree that mandatory 2FA is annoying. If you want to forego security for convenience, that should be up to you. I’m sure you’re not stupid or ignorant of the risks.
As a user its annoying, as a developer it is incredibly frustrating and time consuming.
Huh? How? Implementing OTP (which I’m assuming most people here are talking about) is pretty trivial, and once you have it set up, it doesn’t require much maintenance.
It fails for somebody every day, it adds a dependency for a known unreliable 3rd party that often mangles the identification data it sends back, it is exploited by that 3rd party for extending their monopoly, and it gives that 3rd party (or any hacker that got access to them) full access to impersonate any user it wants.
What?
Implement TOTP and let your users use their preferred authenticator and none of what you’re struggling with will apply.
Oh, yeah, and of course there’s someone on the internet talking about the MFA protocol that no corporation uses.
That one is obligatory too.
(Anyway, yes, if you need MFA, use TOTP. That’s a non-brainier. Except that corporations don’t have brains.)
Which also means you can just copy/paste it alongside username and password with the same manager.
That’s the user’s choice, that should not be a consideration when choosing authentication methods as long as you tell them how to store it properly (in a reasonable way, probably shouldn’t mention keepass or anything like that).
👆️
This is uterly idiotic but ok. I have decided I do not need to wear seat belt in the car. Just because you do and you have good reasons to want it to stay, doesn’t mean everyone comes to the same conclusion based on similar data.
there, now you are getting it.
i dont want you not wearing the seatbelt, it is so easy to do
we live in a society and im tired of paying for stupid doing stupid things
The day my taxes go towards paying for people who don’t have 2fa, we can discuss whether it should be mandatory. Also, comparing a compromised Netflix account to loss of life, really?
comparing cost to society
there is a reason ms forces updates now